The distributed coordination function (DCF) mechanism, which is a CSMA/CA medium access protocol for WLANs, is vulnerable to selfish backoff attacks [20]. This is because selfish devices can set their backoff timers to very small thresholds, allowing them to access channels more frequently than other devices [21]. The CW size determines the range of the random backoff counter for all devices. Normally, minimum and maximum CW values are fixed within the standard. However, a selfish device can manipulate these values to override its priority. Selfish behaviors can include partial dropping, false accusation, packet dropping, and insufficient transmission power effects [22].

Several studies have analyzed selfish attacks, and their countermeasures are largely governed by game theoretic considerations related to managing routing paths, energy usage, and node confidence values. Konorski et al. proposed a game theory-based approach to handle greedy and honest nodes, enabling the latter to overcome their throughput disadvantages, especially with increasing number of nodes. Their simulation results demonstrated that the throughput of greedy nodes gradually decreased because small manipulations of the CW parameter were equally effective for disruptions and remedies [20].

Fihri et al. proposed a support vector machine-based nonlinear classifier to detect backoff manipulation attacks. The model exhibited the shortest execution times among machine learning classifiers, especially when supplied with radial basis function kernel classifiers. Moreover, it exhibited the lowest computational complexity [23]. Kim et al. proposed a method for detecting selfish attacks by mathematically analyzing selfish backoff attacks using logistic classifiers [21]. Malicious nodes typically set the CW value to 1 or 2—their study proved that when it is set to 1, the attacker can immediately access the channel without waiting for a backoff; however, when it is set to 2, other devices can access the channel first. Chakraborty et al. used backoff properties to address collisions during simultaneous transmissions; however, their algorithm did not work properly with large networks [24]. Nonetheless, their results demonstrated that a random-access game theoretical protocol exhibited higher average throughput and lower access delay compared to DCF in the case of WLAN. Odedra et al. combined threshold-based detection methods with watchdog surveillance techniques [23] to improve network performance and reduce the impact of selfish nodes. However, the proposed method was unable to detect cooperating selfish nodes and exhibited limited detection of the incapability of nodes to reengage in routing after isolation.

Jamming attacks are commonplace DoS attacks that cause intentional interference to stifle network communication [25]. Jammers are generally categorized as proactive or reactive, and the proactive type can be further divided into constant, deciphered, and random types [26].

Various studies have suggested methods for detecting and responding to deceptive jamming attacks, but few have suggested an integrated response system that distinguishes between selfish and jamming attack types. Vadlamani et al. conducted a survey and concluded that although a deceptive jammer is similar to a constant jammer, the former transmits a legitimate initial bit sequence to impersonate a legitimate node [27]. Deceptive versions also implement defense strategies against transmission power adjustment, frequency-hopping spread spectrum, channel switching, and directional antenna defenses.

Kanwar et al. proposed the JamSense model, which classifies and detects interference and jamming attacks in WLANs [28]. Their study distinguished between interference, constant jammers, and deceptive jammers. The authors classified the preamble and start-of-the-frame delimiters of the constant and deceptive jammers’ packets in terms of their transmission status. As such, attacks could be identified with up to 96% accuracy. Despite the excellent findings, the impact of these network attacks has not been analyzed further.

Recent advancements in wireless network security have explored various mitigation frameworks aimed at enhancing system reliability and defense against adversarial threats. Liu et al. proposed the RFL-APIA framework, addressing federated learning vulnerabilities by identifying and mitigating model poisoning attacks through robust aggregation mechanisms, which parallels the proposed selective attack mitigation model’s emphasis on adaptive response strategies in WSNs [29]. Bai et al. introduced a Throughput Maximization Model for secure multipath transmissions in wireless ad-hoc networks, focusing on optimizing network throughput while protecting from potential eavesdroppers [30]. Gong et al. explored Computation and Privacy Protection for Satellite-Ground Digital Twin Networks, emphasizing secure data mapping and resource optimization, an idea relevant to dynamic resource allocation in mitigating DoS attacks [31]. These works collectively underscore the necessity of adaptive, intelligent frameworks for real-time network threat detection and response, forming the conceptual basis for the proposed model’s selective attack mitigation strategy.

Fig. 1 presents typical infrastructure for WLAN, where wireless devices communicate with the AP within a coverage region. The underlying MAC mechanism of the IEEE 802.11 WLAN standard [32] is DCF, which uses competition-based algorithms to provide access to shared media [33]. As depicted in Fig. 2, DCF adjusts channel access using the binary exponential backoff (BEB) algorithm [34], which prevents repeated retransmissions of the same packet to reduce network traffic [32]. If the sender detects an idle channel, it waits in the distributed interframe space (DIFS) and transmits its frame. If the channel is detected to be busy, the DIFS time is added to the backoff counter, and the packet is transmitted once the counter reaches zero. The backoff counter is an arbitrary time determined by the BEB and depends on the CW value. If the frame is successfully transmitted, the sender resets the CW value to the minimum value. If the frames collide, the CW is doubled to the maximum value, and a random backoff counter value is selected in [0, CW-1]. When the channel is found to be inactive, its value decreases. When the channel is used, the process is reactivated when the channel is inactive [35].

DCF uses two modes of transport—basic (two-handshake) and RTS/CTS (four-handshake). In the basic mode, the sender detects whether the channel is busy and transmits a data frame if idle. Once the transmitted frame is received successfully, the receiver responds with an acknowledgement frame. The RTS/CTS access mode reserves a channel before data transmission. After receiving the frame, the other nodes update their NAV values based on the field duration of the RTS/CTS value of the reserved frame. The other nodes transmit data frames through the DCF when the NAV value reaches zero.

The IEEE 802.11be standard is expected to be an extremely high-throughput amendment to improve the reliability of wireless communications and increase the maximum throughput by 30 Gbps while reducing latency [36]. Multilink operations comprise the core technology needed to achieve these high expectations. The multilink framework is advantageous because it exhibits multifrequency bands and low hardware costs, such that APs and STAs can simultaneously transmit and receive information on different links using multiple radio interfaces depending on the transmission mode [37].

Multilink transmissions generally include synchronous and asynchronous methods categorized in terms of their simultaneous uplink/downlink (UL/DL) transmission capabilities. In both types, asynchronous transmissions and receptions on one or more links are allowed, and transmission on one link and reception on the other can be supported simultaneously. Additionally, DL frames that fail on one link can be retransmitted to other available links to reduce latency, and some traffic can be switched to other low-load links to improve the quality of service on overloaded links. During asynchronous operations, each link of the multilink device executes its channel process separately. Consequently, each link can achieve an independent maximum favorable throughput. In contrast, in synchronous operations, all links must wait for the idle state to begin transmission. Multiband and multichannel operations are discussed below in conjunction with multilink transmissions designed to improve performance despite heavy interference [35].

Fig. 4 illustrates network performance as a function of the number of STAs during a selfish attack. The network’s maximum application throughput is exceptionally high compared to a normal WLAN model because the maximum throughput is measured from the selfish node. Hence, the throughput of other nodes is diminished to values well below average minimum values. This increases the total bytes transmitted by the selfish node. Consequently, the average minimum application throughput of the other nodes is reduced from 2.96 to 0.28 Mbps, representing a 90.54% degradation in performance.

A deceptive jammer is a type of radio frequency interference device that continuously transmits signals, similar to a constant jammer, but with a more sophisticated approach. Unlike constant jammers, which emit random noise or arbitrary bit sequences, deceptive jammers mimic legitimate communication signals. They transmit seemingly valid data packets or bit patterns that resemble those generated by legitimate devices in the network. Therefore, deceptive jamming attacks remain undetected for longer periods. Since their transmissions appear legitimate, distinguishing between real and fake data becomes challenging for the network. This tactic allows for prolonged disruption without immediate detection, making deceptive jammers more insidious and effective than constant jammers in denial-of-service (DoS) attacks. In addition, jammers adjust their signal strength to fine-tune their effects and avoid detection. Fig. 5 illustrates network performance as a function of the number of STAs during a jamming attack. Table 2 summarizes the simulation parameters, where the interaction time is used to determine the packet generation rate.

Notably, reducing the inter-arrival time increases this rate. To validate the proposed model, a jammer with a transmission power of 100 mW is positioned randomly, and 8-byte packets are transmitted at a rate calculated to achieve 5.8-μs inter-arrival times, resulting in ~17,241 packets generated per second. Because all nodes in the WLAN are capable of a robust 6.5-Mbps data rate, the STAs’ locations do not affect network performance significantly. In our simulation, the jammer follows the same standard as other STAs under normal circumstances. However, it also transmits periodic jamming packets without using the RTS/CTS mechanism. During the simulated attack, the number of packets transmitted to the AP is observed to be ~1000, disrupting its communications with other nodes. The attack is also observed to cause a loss of ~2000 data packets due to collision, whereas none typically crashed during normal WLAN operations. Thus, the jammer reduces the average throughput from 2.96 to 0.12 Mbps.

Table 3 summarizes the data used in this study based on packet log data collected in an attack-integrated model and a related description.

Packet trace log data, including type (data or control), source, destination, layer arrival time, payload size, collision status, queuing time, transmission time, propagation delay, total traveling time, and repetitions of communication occupancy, are simulated or collected from the attack model and compared with WLAN statistics in the absence of an attack.

Queuing delays are simulated by subtracting the time of arrival of the packet at the physical layer from that at the MAC layer [38]. The transmission time is simulated by subtracting the time of arrival of the packet at the physical layer from the time of initial transmission. The propagation delay is simulated by subtracting the time initial transmission time of the packet in the physical layer from the final transmission time in the physical layer. Finally, the total travel time is simulated by summing the queuing, transmission, and propagation delays.

Packets that monopolize communications with the AP and exhibit long durations are assumed to be related to attacks [26,28]. During model training, packet trace logs are analyzed to distinguish between attacks and ordinary packets, and the suspected attacks are classified as jamming or selfish attacks. The data are labeled by dividing the total number of transmitted packets by the number of packets obtained from the suspected jammer, the suspected selfish node, and normal packets.

Fig. 6 describes the proposed attack detection system pipeline, and Algorithm 1 is used to detect jamming and selfish attacks. Fig. 7 depicts the SAMM mechanism’s attack mitigation pipeline. Unintentional continuous occupancy of a single STA with an AP can occur when a DCF mechanism is used with random backoff counters. However, a certain number of constant occupancies can be assumed to be non-coincidental [16]. In the proposed algorithm, the continuous occupancy of a packet that occurs more than thrice is considered to be an attack.

The SAMM classification is based on a light gradient boosting machine (lightGBM) decision-tree model [38] with improved functionality, which exhibits high computation speeds with reduced memory consumption. Additionally, a normalization process is included to avoid overfitting. Using the GBDT boosting type, we trained the model with 400 iterative trees, each with a maximum of 31 leaves. The learning rate was set to 0.1, and the maximum depth of the trees was set to −1. LightGBM is a highly efficient gradient-boosting framework that uses tree-based learning algorithms. Apart from other tree-based algorithms, It applies a more complex leaf-wise split approach to prevent overfitting [39]. In experiments comparing machine learning techniques, LightGBM had the fastest prediction time and model training time [40]. Due to deep learning generally requiring large volumes of labeled data to achieve optimal performance, SAMM applied a machine learning-based model requiring less labeled data for effective training.

The classification performance is evaluated in terms of accuracy and a binary confusion matrix that accounts for true-positive (TP), true-negative (TN), false-negative (FN), and false-positive (FP) predictions. Precision, Recall, F, and F1 scores are derived from these reports, where Precision = TP/(TP + FP), Recall = TP/(TP + FN), F score = weighted average of precision and reproduction rates, and F1 score = harmonic mean of precision and reproduction rates.

Although, the jamming node in a jamming attack may be unknown, the attacker is always obvious in a selfish attack. Hence, a count-based prediction algorithm is used to predict attacks using classified attack alarms while providing information on the suspected attacker node(s). Because multiclass classification algorithms detect attack types, accurate prediction based on the number of attack alarms is possible. In this paper, all predicted attack alarms are placed in a single section, and source-node ratios are calculated and compared.

Following detection and prediction using SAMM, a selective attack mitigation technique is used to respond selectively to the type of attack. In response to selfish attacks, the proposed mitigation system dynamically adjusts contention window (CW) values and backoff counters of non-attacking nodes to immediately reduce network degradation after identifying the attacker. By leveraging game-theoretic principles, the system minimizes control packet collisions during backoff counter reduction, ensuring efficient use of network resources. As illustrated in Fig. 8, smaller CW values significantly enhance the average throughput of non-attacking nodes while increasing control packet collisions. This trade-off demonstrates the system’s capability to maintain network performance even under attack conditions. Notably, decreasing the backoff counter values improves throughput for legitimate nodes. However, if the selfish node detects these adjustments and attempts to lower its backoff counter further, it can exacerbate network competition, causing widespread communication delays. To counter this, the system employs a final mitigation strategy: link switching. By virtually relocating the entire network—excluding the attacker—to a new channel, the system isolates the attacker, preserving the integrity and functionality of the legitimate network.

In response to jamming attacks, the proposed mitigation model suggests adjusting the Receiver Sensitivity (RX sensitivity) and Clear Channel Assessment (CCA) threshold to reduce the impact of interference and maintain network performance. RX sensitivity refers to the minimum signal strength required at the receiver’s antenna port to decode a signal accurately. Reducing RX sensitivity filters out weaker signals, such as those caused by the deceptive jammer, effectively decreasing its disruptive effects. On the other hand, increasing the CCA threshold allows devices to tolerate higher levels of background interference before deciding that the channel is occupied. This adjustment can enhance the ability of legitimate nodes to access the channel despite interference, improving throughput in dense environments. While CCA threshold adjustments primarily aim to mitigate interference rather than identify attackers, they play a crucial role in maintaining network stability by dynamically adapting to the jamming environment. Together, these techniques ensure robust mitigation against jamming attacks without compromising legitimate communication.

A random forest-based anomaly detection model incapable of distinguishing between different attack type or average throughput of the nodes is simulated, and the results are compared with those of SAMM (Fig. 9) [41]. The average node throughput and the number of out-of-service nodes (throughput = 0) are measured during a simulated attack lasting 10 s. Applying the SAMM model is observed to reduce the number of out-of-service nodes significantly and maintain an average throughput of 2.69 Mbps, irrespective of the number of nodes. In comparison, the peak average throughput of the normal detection model is observed to be 0.61 Mbps with no mitigation actions. Notably, surplus nodes impact network performance due to collisions. However, throughput is observed to improve when more than five nodes are implemented in the proposed SAMM environment. Anomaly detection using random forest delivers high performance with a relatively high true positive rate, but for a large dataset, it requires a lot of computational power and leads to long training times. In comparison, the SAMM model provides fast learning by applying LGBM and higher detection accuracy compared to the conventional model by adding a multi-classification detection algorithm to classify attacks apart from normal communication.

Fig. 10 depicts the precision, recall, accuracy, and F1 score of SAMM and the ordinary anomaly detection model. Because the normal model assumes all packets apart from normal ones to be related to attacks, it achieves a precision of 100% but at the cost of a very high FN rate. Additionally, in the absence of an algorithm to determine attack types, it is incapable of mitigating network degradation despite exhibiting an accuracy of 82%. In contrast, SAMM achieves a classification accuracy of 96% and restores/retaines network performance successfully using mitigation techniques. In the experimental environment, the number of STAs was limited to 10, and a significant improvement in throughput was observed under these conditions. Although large-scale WSN environments were not tested, similar performance improvements are expected due to the adaptive nature of the proposed technique. Future research will focus on evaluating scalability and performance in large-scale WSN environments with resource-constrained devices.